CVE-2016-9185 Server-side request forgery in n/a

Q: Is CVE-2016-9185 being exploited?

There is no known exploitation of CVE-2016-9185 in the wild and no public exploit code.

Medium 4.3 Published 4 Nov 2016 Updated 6 Aug 2024

An authenticated user can exploit Server-Side Request Forgery in OpenStack Heat to reveal internal network configuration details.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-9185?

CVE-2016-9185 is a medium-severity server-side request forgery vulnerability in n/a, published on 4 Nov 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

Weakness: CWE-200

Which versions are affected by CVE-2016-9185?

It affects 1 product.

Linux distribution packages (12)

`openstack-heat` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat-api` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat-api-cfn` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat-api-cloudwatch` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat-common` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat-engine` Red Hat:openstack:7::el7	All versions	`0:2015.1.4-3.el7ost`
`openstack-heat` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`
`openstack-heat-api` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`
`openstack-heat-api-cfn` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`
`openstack-heat-api-cloudwatch` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`
`openstack-heat-common` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`
`openstack-heat-engine` Red Hat:openstack:8::el7	All versions	`1:5.0.3-2.el7ost`

Products include Openstack Heat.

How do I fix CVE-2016-9185?

Apply the vendor's patch.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2016-9185 being exploited?

There is no known exploitation of CVE-2016-9185 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-9185, GHSA-249h-g975-9xj2, RHSA-2017:1450, RHSA-2017:1456.